Splunk Search

configuring field extraction

Tridi123
New Member

Hi,
I want to enable automatic field extraction from header. My file looks like this format

emp|age|place

12345|28|india

how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.As i am doing poc on it.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

For a search time manual field extraction with a regex.


mysearch | rex "(?[^|])\|(?[^|])\|(?[^|]*)" | table emp age place

For an automatic field extraction,

see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Extractfieldsfromfileheadersatindextime
on the search-head or indexer, define a search time field extraction for your sourcetype.
in props.conf


[mysourcetype]
TRANSFORMS-mysourcetypefields = mysourcetypefieldsextraction

in transforms.conf

[mysourcetypefieldsextraction]
FIELDS="emp", "age", "place"
DELIMS="|"

Simon
Contributor

Did you try KV_MODE = multi in props.conf (http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Propsconf) ?

0 Karma

Tridi123
New Member

To turn on automatic header-based field extraction for a source or source type, add CHECK_FOR_HEADER=TRUE then [deatils]--------------sourcetype CHECK_FOR_HEADER=TRUE
then should i give KV_MODE = multi

0 Karma

Tridi123
New Member

link is not opening

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...